Repository navigation
Upgrade Better Auth to 1.7.16 for the 2026-11-03 security release (#8843) - #3583
Merged
Merged
Conversation
…843) * Upgrade Better Auth to 1.7.16 for the 2026-11-03 security release Moves better-auth, @better-auth/sso and @better-auth/oauth-provider from 1.6.x to 1.7.16 and @better-auth/infra from 0.2.5 to 0.4.26. The advisory fixes only ship on 1.7.16, so this takes the 1.7 breaking changes too. Config: - validAudiences is gone; the same three identifiers move to resources. - enforcePerClientResources: false, because no existing DCR client is linked to a resource and 1.7 would otherwise answer invalid_target. - clientRegistrationDefaultApplicationType: 'infer', so MCP clients that register a loopback redirect without application_type (Cursor, older Claude Code) are treated as native apps instead of rejected. - The organization adapter wrapper now uses the slug as the id when a create arrives without one; infra 0.4.26 drops the id that beforeCreateOrganization sets on the dash create path. Schema: runtime migration 0045 adds the 1.7 oauth-provider tables and columns, jwks alg/crv, and unique device codes and refresh tokens. It deletes expired device codes first and rekeys Microsoft accounts to the Entra oid claim, which 1.7 uses as the account id. Dependencies: zod ^4.6.7 and jose ^6.2.15 across public/agents so the plugins share one @better-auth/core with better-auth, and better-call 1.4.5 as a direct agents-core dependency so the auth types can be named. zod 4.6 throws when omit() names a key a schema lacks, so the shared omit helpers now omit only keys that exist. The 12 fresh packages get exact-version cooldown excludes (Emergency-CVE exception); they come out once the releases clear the 3-day window. * Keep zod 4.3 key semantics on zod 4.6 and align support-copilot-agents Since zod 4.5, an object key typed z.unknown() or z.any() is required; on 4.3 it was implicitly optional. That failed about 120 agents-cli tests and could change API validation. Every such key in public/agents (24 in 11 files, plus the AgentSession JSON-schema converter and the SDK's generated MCP server template) now says .optional(), which matches the 4.3 behavior exactly, including the JSON schema sent to models. support-copilot-agents passes zod schemas into the agents SDK, so it moves to zod ^4.6.7 as well; the drift allowlist entry follows. * Address review on the Better Auth 1.7 upgrade - SSO docs: the issuer must match the discovery document exactly, issuer and client edits are refused once users have signed in, and a first SSO sign-in no longer links to an existing account with the same email. - Login page: show a clear message for account_not_linked instead of the raw error code. - Migration 0045: the Microsoft rekey only skips tokens that fail to decode (data_exception); any other error aborts. It reports how many accounts were rekeyed and warns with the count left on sub. A test runs the block against valid, malformed and missing tokens. - The MCP flow test verifies tokens against the instance's JWKS with the issuer and audiences agents-api uses. - Changeset names the zod ^4.6.7 floor, the issuer step and the linking change. * Send failed SSO and social sign-ins back to the login page Without errorCallbackURL, Better Auth sends a failed SSO or social sign-in to the API's /error page, so the account-not-linked message never reached users on the default path. The login and accept-invitation pages now pass an errorCallbackURL on /login that keeps the invitation and returnUrl context, and the message mapping moves to lib/sign-in-errors.ts with tests for both spellings Better Auth uses. SSO docs: removing a provider unlinks every member who signed in through it and re-adding it does not reconnect them, so remove-and-re-add is no longer offered as a way to change the issuer. Also drops .optional() from six OpenAPI response schemas, where it had no effect, and matches schemas.ts's .nullable().optional() order. * Remove sign-in links left behind by deleted SSO providers @better-auth/sso up to 1.6.20 kept a provider's account rows when the provider was deleted (GHSA-prpr-5gj3-qqhg), so a new provider registered with the same providerId could sign in as those users. 1.7 stops new orphans but leaves old ones. Migration 0045 now deletes account rows whose provider is neither credential, google, microsoft nor an existing SSO provider; those are the only sign-in methods createAuth configures. Users, memberships and their other sign-in methods are untouched. GitOrigin-RevId: 7053c07fc8399089379bf707de6e3700b38195f4
🦋 Changeset detectedLatest commit: 3bab180 The changes in this PR will be included in the next version bump. This PR includes changesets to release 10 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
🔎💬 Inkeep AI search and chat service is syncing content for source 'Inkeep Agent Framework Docs' |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Copybara-translated 1 Inkeep OSS change. Rebase-merge this PR so the prepared commit lands directly on public main.